Overview
Indian teams increasingly host in Mumbai, Hyderabad or Delhi cloud regions to keep data close to customers. Choosing a region does not secure an account, though. We review identity, storage, networking and logging across AWS, Azure and Google Cloud, then test what an attacker could reach by chaining weak settings together. We also note whether the logs CERT-In expects to be kept within India for 180 days are actually being retained.
Cloud platforms shift the risk from unpatched software to how you configure identity and access. The provider secures the infrastructure; everything above it, who can do what, what is exposed to the internet, and how services trust one another, is yours to get right. A cloud assessment examines that configured surface the way an attacker with a leaked key or a foothold would, looking for the permissions and exposures that turn a small mistake into account-wide access.
We work through identity first, because it is where cloud compromise lives. Over-broad roles, unused but powerful permissions, keys that never expire, and policies that allow a principal to grant itself more access all create privilege-escalation paths that are invisible until mapped. From there we assess exposed storage buckets and databases, public services and network rules, secrets left in metadata or configuration, and the trust between accounts, subscriptions or projects.
This is a configuration and identity review conducted within your provider's testing policy, not an attempt to attack the provider's platform. Findings are tied to the specific resource and setting, scored with CVSS v4.0, and paired with the exact change, an IAM policy, a bucket setting, a network rule, that fixes them. Where you run across more than one provider, we normalise the findings so your team sees a single prioritised list.
How we work with Indian clients
- Fixed-price proposals in INR, with 18% GST shown separately on every invoice
- Remote-first delivery from Ahmedabad in IST working hours; on-site work can be discussed at scoping
- Signed authorisation, an NDA on request and agreed testing windows before any activity begins
- Reports and closure evidence shaped for RBI, SEBI CSCRF, IRDAI, DPDP, ISO 27001 and PCI DSS reviews
What's included
Our approach
- Scope & accessWe confirm accounts, provider policy and the access needed for the review.
- Configuration reviewWe assess identity, storage, network and service settings across the estate.
- Path analysisWe map privilege-escalation and lateral paths between identities and accounts.
- ValidationWe safely demonstrate impactful paths within the provider's testing policy.
- Report & debriefFindings are tied to resources and settings with exact remediation.
What you receive
- Identity and privilege-escalation path analysis
- Inventory of exposed storage, data and services
- Findings scored with CVSS v4.0 per resource
- Exact configuration changes to remediate
- Free retest of fixed issues and an attestation letter
Standards & frameworks
- CIS Benchmarks
- NIST SP 800-115
- MITRE ATT&CK
- OWASP WSTG
- CVSS v4.0
- CWE
- CERT-In Directions 2022
- RBI IT Governance Direction 2023
Frequently asked questions
Do you attack the cloud provider itself?
No. We test your configuration and identity within the provider's acceptable-use and testing policy. Attacking the provider's shared infrastructure is both prohibited and beside the point, since your risk lives in how you set up and permission your own account.
What access do you need?
A read-oriented review role across the accounts in scope lets us assess configuration thoroughly and safely. For targeted exploitation of a path we agree the specific permissions with you first, so the engagement stays within the access you intend to grant.
Can you test more than one provider at once?
Yes. Many organisations run across AWS, Azure and GCP, and we assess each against its own best practice while presenting a single normalised, prioritised list of findings so your team is not juggling three separate reports.
Can internal and Active Directory testing be done without a site visit?
Usually, yes. We connect through a VPN you provide or a small preconfigured device that your team plugs in at the office. On-site work can be discussed at scoping where a network needs it.
Will you look at our CERT-In log and time-sync settings?
When infrastructure is in scope, we note whether logs appear to be kept for the 180 days the 2022 CERT-In Directions require and whether systems sync time with NIC or NPL servers. Treat this as a technical observation, not a legal opinion.